Getting Data In

How to tell what caused overage?

rainhailrob
Path Finder

I was testing Splunk App for *nix before putting it into production. We were consistently getting 30-40Mb/day, but while I was out of the office (14 days), the usage went over the 500Mb limit. I'm trying to determine what caused the overage and by how much before moving to production and having even bigger problems if we go over our 10Gb license.

Apps > Search > Status > Index Activity > Indexing
is displaying less than 100Mb per day.

Any ideas?

0 Karma
1 Solution

jgedeon120
Contributor

Install the Splunk on Splunk app and you will be able to look at more details of your index usage and the sources, sourcetypes to see what/where the increase was caused.

View solution in original post

0 Karma

rainhailrob
Path Finder

I was able to get reset key from Rob, but now when I go to Deployment Monitor > License Report

Usage Summary
Peak daily usage in last 30 days: 0.06 GB
Average daily usage across all days in last 30 days: 0.06 GB
Average usage across top 5 days in last 30 days: 0.06 GB

The Splunk on Splunk Metrics shows the same .06Gb

So now I'm really confused.

0 Karma

jgedeon120
Contributor

Install the Splunk on Splunk app and you will be able to look at more details of your index usage and the sources, sourcetypes to see what/where the increase was caused.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...